@getstrata/core 2.2.40 → 2.2.41

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @getstrata/core changelog
 
+## 2.2.41
+
+Make framework HTML/JSON error responses non-storeable, including configured/fallback renderers and custom-body 404 responses; retain success-response cache policy and add packed header regressions.
+
+Fix packaged error wrappers ignoring the configured application error renderer; preserve API JSON precedence and add packed configured/default rendering regressions.
+
+Fix packaged membership middleware and default service ignoring the configured application lookup. Use the canonical membership context while preserving explicit service injection and request isolation. Add mandatory packed external-app coverage for concurrent users, replacement configuration and propagated lookup failures.
+
 ## 2.2.40
 
 Fix shared DNS fixture state in packaged outbound consumers. safeFetch and GitHub OAuth now use the canonical safeUrl resolver while retaining DNS pinning, private-address validation and request deadlines. Add mandatory packed external-app regressions for resolver replacement and private-target refusal; document controlled-provider qualification limits.

package/dist/entries/auth/membershipMiddleware.js

@@ -1,118 +1,6 @@
 // @bun
-var __esm = (fn, res, err) => () => {
-  if (fn)
-    try {
-      res = fn(fn = 0);
-    } catch (e) {
-      err = [e];
-    }
-  if (err)
-    throw err[0];
-  return res;
-};
-
-// ../../src/core/runtime/asyncContextStore.ts
-import { AsyncLocalStorage } from "async_hooks";
-function createAsyncContextStore(key) {
-  const symbol = Symbol.for(key);
-  const globalRecord = globalThis;
-  const existing = globalRecord[symbol];
-  if (existing) {
-    return existing;
-  }
-  const store = new AsyncLocalStorage;
-  globalRecord[symbol] = store;
-  return store;
-}
-var init_asyncContextStore = () => {};
-
-// ../../src/core/auth/membershipContext.ts
-init_asyncContextStore();
-
-// ../../src/core/auth/accessControl.ts
-import { ForbiddenError } from "@getstrata/core/errors/http";
-
-// ../../src/core/auth/authContext.ts
-init_asyncContextStore();
-var authContext = createAsyncContextStore("@getstrata/authContext");
-var credentialSourceContext = createAsyncContextStore("@getstrata/credentialSource");
-function currentAuthUser() {
-  return authContext.getStore() ?? null;
-}
-
-// ../../src/core/auth/accessControl.ts
-var ROLE_RANK = {
-  member: 1,
-  admin: 2,
-  owner: 3
-};
-function isGlobalAdmin(user) {
-  return user?.role === "admin";
-}
-function hasMinimumOrgRole(role, minimum) {
-  if (!role) {
-    return false;
-  }
-  return ROLE_RANK[role] >= ROLE_RANK[minimum];
-}
-function requireAuthenticatedUser() {
-  const user = currentAuthUser();
-  if (!user) {
-    throw new ForbiddenError("Authentication required.");
-  }
-  return user;
-}
-function resolveUserId(user) {
-  const userId = typeof user.id === "number" ? user.id : Number(user.id);
-  if (!Number.isInteger(userId) || userId <= 0) {
-    throw new ForbiddenError("Invalid authenticated user.");
-  }
-  return userId;
-}
-
-// ../../src/core/auth/membershipContext.ts
-var membershipContext = createAsyncContextStore("@getstrata/membershipContext");
-var uninitializedMembershipLookup = {
-  async listForUser() {
-    return [];
-  },
-  async findMembership() {
-    return null;
-  },
-  async listForOrganization() {
-    return [];
-  },
-  async addMember() {
-    throw new Error("configureMembershipLookup() must be called before mutating memberships.");
-  },
-  async removeMember() {
-    throw new Error("configureMembershipLookup() must be called before mutating memberships.");
-  },
-  async updateMemberRole() {
-    throw new Error("configureMembershipLookup() must be called before mutating memberships.");
-  }
-};
-var membershipRepository = uninitializedMembershipLookup;
-function resolveMembershipLookup() {
-  return membershipRepository;
-}
-async function runWithMembershipContext(callback) {
-  const user = currentAuthUser();
-  if (!user || isGlobalAdmin(user)) {
-    return await callback();
-  }
-  const memberships = await membershipRepository.listForUser(resolveUserId(user));
-  const context = {
-    organizationIds: memberships.map((membership) => membership.organization_id),
-    rolesByOrganizationId: new Map(memberships.map((membership) => [membership.organization_id, membership.role]))
-  };
-  return await membershipContext.run(context, callback);
-}
-function currentOrganizationIds() {
-  return membershipContext.getStore()?.organizationIds ?? [];
-}
-
 // ../../src/core/auth/membershipContextMiddleware.ts
+import { runWithMembershipContext } from "@getstrata/core/auth/membershipContext";
 function createMembershipContextMiddleware() {
   return async (_request, next) => {
     return await runWithMembershipContext(async () => await next());

package/dist/entries/auth/membershipScope.js

@@ -74,42 +74,6 @@ function resolveUserId(user) {
 // ../../src/core/auth/membershipContext.ts
 init_asyncContextStore();
 var membershipContext = createAsyncContextStore("@getstrata/membershipContext");
-var uninitializedMembershipLookup = {
-  async listForUser() {
-    return [];
-  },
-  async findMembership() {
-    return null;
-  },
-  async listForOrganization() {
-    return [];
-  },
-  async addMember() {
-    throw new Error("configureMembershipLookup() must be called before mutating memberships.");
-  },
-  async removeMember() {
-    throw new Error("configureMembershipLookup() must be called before mutating memberships.");
-  },
-  async updateMemberRole() {
-    throw new Error("configureMembershipLookup() must be called before mutating memberships.");
-  }
-};
-var membershipRepository = uninitializedMembershipLookup;
-function resolveMembershipLookup() {
-  return membershipRepository;
-}
-async function runWithMembershipContext(callback) {
-  const user = currentAuthUser();
-  if (!user || isGlobalAdmin(user)) {
-    return await callback();
-  }
-  const memberships = await membershipRepository.listForUser(resolveUserId(user));
-  const context = {
-    organizationIds: memberships.map((membership) => membership.organization_id),
-    rolesByOrganizationId: new Map(memberships.map((membership) => [membership.organization_id, membership.role]))
-  };
-  return await membershipContext.run(context, callback);
-}
 function currentOrganizationIds() {
   return membershipContext.getStore()?.organizationIds ?? [];
 }

package/dist/entries/auth/membershipService.js

@@ -27,6 +27,7 @@ function createAsyncContextStore(key) {
 var init_asyncContextStore = () => {};
 
 // ../../src/core/auth/membershipService.ts
+import { resolveMembershipLookup } from "@getstrata/core/auth/membershipContext";
 import { ForbiddenError as ForbiddenError2 } from "@getstrata/core/errors/http";
 
 // ../../src/core/auth/accessControl.ts
@@ -70,49 +71,6 @@ function resolveUserId(user) {
   return userId;
 }
 
-// ../../src/core/auth/membershipContext.ts
-init_asyncContextStore();
-var membershipContext = createAsyncContextStore("@getstrata/membershipContext");
-var uninitializedMembershipLookup = {
-  async listForUser() {
-    return [];
-  },
-  async findMembership() {
-    return null;
-  },
-  async listForOrganization() {
-    return [];
-  },
-  async addMember() {
-    throw new Error("configureMembershipLookup() must be called before mutating memberships.");
-  },
-  async removeMember() {
-    throw new Error("configureMembershipLookup() must be called before mutating memberships.");
-  },
-  async updateMemberRole() {
-    throw new Error("configureMembershipLookup() must be called before mutating memberships.");
-  }
-};
-var membershipRepository = uninitializedMembershipLookup;
-function resolveMembershipLookup() {
-  return membershipRepository;
-}
-async function runWithMembershipContext(callback) {
-  const user = currentAuthUser();
-  if (!user || isGlobalAdmin(user)) {
-    return await callback();
-  }
-  const memberships = await membershipRepository.listForUser(resolveUserId(user));
-  const context = {
-    organizationIds: memberships.map((membership) => membership.organization_id),
-    rolesByOrganizationId: new Map(memberships.map((membership) => [membership.organization_id, membership.role]))
-  };
-  return await membershipContext.run(context, callback);
-}
-function currentOrganizationIds() {
-  return membershipContext.getStore()?.organizationIds ?? [];
-}
-
 // ../../src/core/auth/resolveMembershipService.ts
 import { resolveApplicationDependencies } from "@getstrata/core/runtime/applicationRegistry";
 function resolveMembershipService() {

package/dist/entries/http/memoryThrottleMiddleware.js

@@ -403,7 +403,9 @@ async function renderWebErrorHtml(input) {
   }
 }
 async function htmlErrorResponse(input) {
-  return htmlResponse(await renderWebErrorHtml(input), { status: input.status });
+  const response = htmlResponse(await renderWebErrorHtml(input), { status: input.status });
+  response.headers.set("Cache-Control", "no-store");
+  return response;
 }
 
 // ../../src/core/http/contentNegotiation.ts

package/dist/entries/http/response.js

@@ -121,7 +121,8 @@ var init_transactionControl = __esm(() => {
 });
 
 // ../../src/core/http/response.ts
-import { toHttpError as toHttpError3 } from "@getstrata/core/errors/http";
+import { toHttpError as toHttpError2 } from "@getstrata/core/errors/http";
+import { logServerError, webErrorResponse } from "@getstrata/core/http/webErrorResponse";
 
 // ../../src/core/database/errors.ts
 import {
@@ -258,302 +259,6 @@ function currentRequestMeta() {
   };
 }
 
-// ../../src/core/http/webErrorResponse.ts
-import { toHttpError as toHttpError2, ValidationError } from "@getstrata/core/errors/http";
-import { appLogger } from "@getstrata/core/logging/logger";
-
-// ../../src/core/runtime/appEnv.ts
-var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
-function normalizeEnvValue(value) {
-  return (value ?? "").trim().toLowerCase();
-}
-function isProductionEnv(env = process.env) {
-  const appEnv = normalizeEnvValue(env.APP_ENV);
-  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
-  if (appEnv === "production" || nodeEnv === "production") {
-    return true;
-  }
-  if (appEnv === "") {
-    return false;
-  }
-  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
-}
-function envFlagEnabled(value) {
-  return value === "true";
-}
-
-// ../../src/core/runtime/frontendMode.ts
-var FRONTEND_MODES = ["api", "server-htmx", "spa-react", "hybrid"];
-var DEFAULT_SPA_PREFIX = "/app";
-var FRONTEND_MODE_PATTERN = new RegExp(`^(${FRONTEND_MODES.join("|")})$`);
-function parseFrontendMode(value) {
-  const mode = (value ?? "api").trim();
-  if (mode === "server-htmx" || mode === "spa-react" || mode === "hybrid") {
-    return mode;
-  }
-  return "api";
-}
-function readFrontendMode() {
-  return parseFrontendMode(process.env.FRONTEND_MODE);
-}
-function isViewsMode(mode) {
-  return mode === "server-htmx" || mode === "hybrid";
-}
-function isSpaMode(mode) {
-  return mode === "spa-react" || mode === "hybrid";
-}
-function isViewsEnabled() {
-  return isViewsMode(readFrontendMode());
-}
-function isSpaEnabled() {
-  return isSpaMode(readFrontendMode());
-}
-function normalizeSpaPrefix(value) {
-  const raw = (value ?? DEFAULT_SPA_PREFIX).trim() || DEFAULT_SPA_PREFIX;
-  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
-  const trimmed = withSlash.replace(/\/+$/, "");
-  if (trimmed.length === 0 || trimmed === "/") {
-    return DEFAULT_SPA_PREFIX;
-  }
-  return trimmed;
-}
-function readSpaPrefix() {
-  return normalizeSpaPrefix(process.env.SPA_PREFIX);
-}
-
-// ../../src/core/view/webErrorView.ts
-import { currentRequestMeta as currentRequestMeta2 } from "@getstrata/core/http/requestMetaContext";
-
-// ../../src/core/http/safeInternalPath.ts
-var NESTED_REDIRECT_KEYS = new Set(["redirect", "next", "return", "returnTo", "return_to"]);
-function looksLikeExternalTarget(value) {
-  const trimmed = value.trim();
-  if (!trimmed.startsWith("/") || trimmed.startsWith("//") || trimmed.includes("\\")) {
-    return true;
-  }
-  if (trimmed.includes("://") || trimmed.includes(":/") || trimmed.includes(":\\")) {
-    return true;
-  }
-  try {
-    const decoded = decodeURIComponent(trimmed);
-    if (decoded.startsWith("//") || decoded.includes("\\") || /https?:/i.test(decoded)) {
-      return true;
-    }
-  } catch {
-    return true;
-  }
-  return false;
-}
-function sanitizeNestedQuery(search) {
-  if (!search) {
-    return "";
-  }
-  const params = new URLSearchParams(search.startsWith("?") ? search.slice(1) : search);
-  const next = new URLSearchParams;
-  for (const [key, value] of params.entries()) {
-    if (NESTED_REDIRECT_KEYS.has(key)) {
-      const sanitized = sanitizeInternalPath(value, "/");
-      next.set(key, sanitized);
-      continue;
-    }
-    if (looksLikeExternalTarget(value) && value.includes("://")) {
-      continue;
-    }
-    next.set(key, value);
-  }
-  const serialized = next.toString();
-  return serialized ? `?${serialized}` : "";
-}
-function sanitizeInternalPath(raw, fallback = "/") {
-  const trimmed = raw.trim();
-  if (looksLikeExternalTarget(trimmed)) {
-    return fallback;
-  }
-  const queryIndex = trimmed.indexOf("?");
-  const hashIndex = trimmed.indexOf("#");
-  const end = [queryIndex, hashIndex].filter((index) => index >= 0).sort((a, b) => a - b)[0];
-  const pathname = end === undefined ? trimmed : trimmed.slice(0, end);
-  if (looksLikeExternalTarget(pathname)) {
-    return fallback;
-  }
-  const search = queryIndex >= 0 ? trimmed.slice(queryIndex, hashIndex >= 0 ? hashIndex : undefined) : "";
-  return `${pathname}${sanitizeNestedQuery(search)}`;
-}
-function safeInternalRedirectPath(request, fallback = "/") {
-  const url = new URL(request.url);
-  return sanitizeInternalPath(`${url.pathname}${url.search}`, fallback);
-}
-function loginRedirectLocation(request) {
-  return `/login?redirect=${encodeURIComponent(safeInternalRedirectPath(request))}`;
-}
-
-// ../../src/core/view/htmlResponse.ts
-function htmlResponse(html, init = {}) {
-  return new Response(html, {
-    status: init.status ?? 200,
-    statusText: init.statusText,
-    headers: {
-      "Content-Type": "text/html; charset=utf-8"
-    }
-  });
-}
-
-// ../../src/core/view/webErrorView.ts
-var configuredErrorView = {};
-function escapeHtml(value) {
-  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
-}
-function errorReturnPath(request) {
-  if (!request)
-    return "/";
-  try {
-    const current = new URL(request.url);
-    const previous = new URL(request.headers.get("referer") ?? "");
-    if (previous.origin !== current.origin || (request.method === "GET" || request.method === "HEAD") && previous.pathname === current.pathname)
-      return "/";
-    return sanitizeInternalPath(previous.pathname, "/");
-  } catch {
-    return "/";
-  }
-}
-function renderKernelErrorChrome(input) {
-  const title = escapeHtml(input.title);
-  const message = escapeHtml(input.message);
-  const errorLines = Object.entries(input.errors ?? {}).flatMap(([field, messages]) => messages.map((item) => `${field}: ${item}`)).map((line) => `<li>${escapeHtml(line)}</li>`).join("");
-  const details = errorLines ? `<ul class="error-list">${errorLines}</ul>` : "";
-  const goBack = input.status === 422 ? `<p><a href="${escapeHtml(errorReturnPath(input.request ?? currentRequestMeta2().request))}">Go back</a></p>` : "";
-  return `<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>${title}</title>
-    <link rel="stylesheet" href="/assets/app.css" />
-  </head>
-  <body>
-    <header class="site-header">
-      <a class="brand" href="/">Home</a>
-    </header>
-    <main class="site-main">
-      <section class="page-header">
-        <h1>${title}</h1>
-        <p>${message}</p>
-        ${details}
-        ${goBack}
-      </section>
-    </main>
-  </body>
-</html>
-`;
-}
-async function renderWebErrorHtml(input) {
-  const render = configuredErrorView.render;
-  if (!render) {
-    return renderKernelErrorChrome(input);
-  }
-  try {
-    return await render({
-      ...input,
-      request: input.request ?? currentRequestMeta2().request
-    });
-  } catch {
-    return renderKernelErrorChrome(input);
-  }
-}
-async function htmlErrorResponse(input) {
-  return htmlResponse(await renderWebErrorHtml(input), { status: input.status });
-}
-
-// ../../src/core/http/contentNegotiation.ts
-function requestPrefersJson(request) {
-  if (!request) {
-    return true;
-  }
-  if (request.headers.get("HX-Request") === "true") {
-    return false;
-  }
-  const pathname = new URL(request.url).pathname;
-  if (pathname.startsWith("/api/")) {
-    return true;
-  }
-  const accept = request.headers.get("accept")?.toLowerCase() ?? "";
-  if (accept.includes("text/html")) {
-    return false;
-  }
-  if (accept.includes("application/json")) {
-    return true;
-  }
-  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
-  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-    return false;
-  }
-  return false;
-}
-
-// ../../src/core/http/webErrorResponse.ts
-function normalizeFieldErrors(details) {
-  if (!details || typeof details !== "object" || Array.isArray(details)) {
-    return {};
-  }
-  const errors = {};
-  for (const [field, messages] of Object.entries(details)) {
-    if (Array.isArray(messages)) {
-      errors[field] = messages.map(String);
-      continue;
-    }
-    if (typeof messages === "string") {
-      errors[field] = [messages];
-    }
-  }
-  return errors;
-}
-function errorPageTitle(status, message) {
-  if (status === 404) {
-    return "Not Found";
-  }
-  if (status === 403) {
-    return "Forbidden";
-  }
-  if (status >= 500) {
-    return "Server Error";
-  }
-  return message;
-}
-function publicErrorMessage(status, message) {
-  if (status >= 500 && isProductionEnv()) {
-    return "Something went wrong.";
-  }
-  return message;
-}
-function logServerError(error, mappedError) {
-  if (mappedError.status < 500) {
-    return;
-  }
-  appLogger.error("Unhandled request error", {
-    status: mappedError.status,
-    error: error instanceof Error ? error.message : String(error),
-    stack: error instanceof Error ? error.stack : undefined
-  });
-}
-async function webErrorResponse(error, request) {
-  if (currentRequestMeta().errorFormat === "json" || !request || !isViewsEnabled() || requestPrefersJson(request)) {
-    return null;
-  }
-  const mappedError = toHttpError2(error) ?? mapDatabaseError(error);
-  logServerError(error, mappedError);
-  if (mappedError.status === 401) {
-    return Response.redirect(loginRedirectLocation(request), 302);
-  }
-  const errors = mappedError instanceof ValidationError || mappedError.name === "ValidationError" ? normalizeFieldErrors(mappedError.details) : undefined;
-  return htmlErrorResponse({
-    status: mappedError.status,
-    title: errorPageTitle(mappedError.status, mappedError.message),
-    message: publicErrorMessage(mappedError.status, mappedError.message),
-    errors,
-    request
-  });
-}
-
 // ../../src/core/http/response.ts
 function jsonResponse(data, init = {}) {
   return Response.json(data, {
@@ -568,12 +273,12 @@ function noContentResponse() {
   return new Response(null, { status: 204 });
 }
 function errorResponse(error) {
-  const mappedError = toHttpError3(error) ?? mapDatabaseError(error);
+  const mappedError = toHttpError2(error) ?? mapDatabaseError(error);
   logServerError(error, mappedError);
   return Response.json({
     error: mappedError.message,
     ...mappedError.details === undefined ? {} : { details: mappedError.details }
-  }, { status: mappedError.status });
+  }, { status: mappedError.status, headers: { "Cache-Control": "no-store" } });
 }
 function withErrorHandling(handler) {
   return async (...args) => {

package/dist/entries/http/scimThrottleMiddleware.js

@@ -457,7 +457,9 @@ async function renderWebErrorHtml(input) {
   }
 }
 async function htmlErrorResponse(input) {
-  return htmlResponse(await renderWebErrorHtml(input), { status: input.status });
+  const response = htmlResponse(await renderWebErrorHtml(input), { status: input.status });
+  response.headers.set("Cache-Control", "no-store");
+  return response;
 }
 
 // ../../src/core/http/contentNegotiation.ts

package/dist/entries/http/throttleMiddleware.js

@@ -342,7 +342,9 @@ async function renderWebErrorHtml(input) {
   }
 }
 async function htmlErrorResponse(input) {
-  return htmlResponse(await renderWebErrorHtml(input), { status: input.status });
+  const response = htmlResponse(await renderWebErrorHtml(input), { status: input.status });
+  response.headers.set("Cache-Control", "no-store");
+  return response;
 }
 
 // ../../src/core/http/contentNegotiation.ts

package/dist/index.js

@@ -12745,9 +12745,6 @@ function toPaginatedResourceCollection(items, meta, transformer) {
     meta
   };
 }
-// ../../src/core/http/response.ts
-init_transactionControl();
-
 // ../../src/core/http/safeInternalPath.ts
 var NESTED_REDIRECT_KEYS = new Set(["redirect", "next", "return", "returnTo", "return_to"]);
 function looksLikeExternalTarget(value) {
@@ -12933,11 +12930,15 @@ async function renderWebErrorHtml(input) {
   }
 }
 async function htmlErrorResponse(input) {
-  return htmlResponse(await renderWebErrorHtml(input), { status: input.status });
+  const response = htmlResponse(await renderWebErrorHtml(input), { status: input.status });
+  response.headers.set("Cache-Control", "no-store");
+  return response;
 }
 async function notFoundHtmlResponse(body) {
   if (body !== undefined) {
-    return htmlResponse(body, { status: 404 });
+    const response = htmlResponse(body, { status: 404 });
+    response.headers.set("Cache-Control", "no-store");
+    return response;
   }
   return htmlErrorResponse({
     status: 404,
@@ -13037,6 +13038,7 @@ async function webErrorResponse(error, request) {
 }
 
 // ../../src/core/http/response.ts
+init_transactionControl();
 function jsonResponse2(data, init = {}) {
   return Response.json(data, {
     status: init.status ?? 200,
@@ -13055,7 +13057,7 @@ function errorResponse(error) {
   return Response.json({
     error: mappedError.message,
     ...mappedError.details === undefined ? {} : { details: mappedError.details }
-  }, { status: mappedError.status });
+  }, { status: mappedError.status, headers: { "Cache-Control": "no-store" } });
 }
 function withErrorHandling(handler) {
   return async (...args) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "2.2.40",
+  "version": "2.2.41",
   "description": "Strata Bun framework public API",
   "type": "module",
   "license": "MIT",